ec8492431c
- Banned functions: 15 rules, 0 fold detectors — largest gap - Crypto misuse: 8 rules completely uncovered - Phase 1: 9 syntactic detectors covering 30+ Semgrep rules - What fold does better: Z3 proofs, CFG analysis, type-aware checking
2.9 KiB
2.9 KiB
Semgrep C/C++ Rules vs fold Detectors — Gap Matrix
Generated 2026-05-29. Maps Semgrep's
p/candp/cpprulesets (~80 rules) to fold detectors.
Coverage Summary
| Category | Semgrep Rules | fold Has | fold Missing |
|---|---|---|---|
| Banned/deprecated functions | ~15 | 0 | 15 |
| Memory safety | ~10 | 7 | 3 |
| Injection | ~8 | 1 | 7 |
| Crypto misuse | ~8 | 0 | 8 |
| Information disclosure | ~6 | 0 | 6 |
| Resource management | ~5 | 3 | 2 |
| Input validation | ~5 | 0 | 5 |
| Concurrency | ~4 | 0 | 4 |
| Style/quality | ~20 | 0 | 20 |
| Total | ~80 | 11 | ~70 |
Key Gaps fold Could Close (Phase 1 — Syntactic)
Semgrep's strength is pattern-matching. These rules require NO Z3 — just AST pattern matching like fold's existing deprecated_api.cpp:
| Semgrep Rule | fold Detector | Pattern |
|---|---|---|
c.lang.security.insecure-use-gets |
deprecated-gets |
gets(...) call |
c.lang.security.insecure-use-sprintf |
deprecated-sprintf |
sprintf(buf, fmt, ...) with non-literal fmt |
c.lang.security.insecure-use-strcpy |
deprecated-strcpy |
strcpy(dst, src) call |
c.lang.security.insecure-use-strcat |
deprecated-strcat |
strcat(dst, src) call |
cpp.lang.security.insufficient-key-size |
weak-crypto |
RSA < 2048, ECC < 256 bit |
c.lang.security.insecure-use-printf-fn |
format-string |
Non-literal format arg to printf family |
c.lang.security.md5-used-as-password |
weak-crypto-md5 |
MD5() in password/hash context |
c.lang.security.sha1-used-as-password |
weak-crypto-sha1 |
SHA1() in password context |
Semgrep Rules Impossible for fold
Patterns requiring whole-program or cross-file context that fold's single-TU design can't express:
| Rule | Why Not |
|---|---|
insecure-use-memset |
Context-dependent (memset to zero before free is secure, other uses vary) |
detect-http-to-https-redirect |
Requires HTTP protocol semantics |
detect-weak-tls-ciphers |
Requires runtime config analysis |
Recommended Priority
| Priority | Rules | Approach | Effort |
|---|---|---|---|
| 1 | Banned functions (5 rules) | Syntactic, extend deprecated_api.cpp | S |
| 2 | Crypto misuse (3 rules) | Syntactic, new weak-crypto detector | S |
| 3 | Format string (1 rule) | Syntactic, new format-string detector | S |
| 4 | Input validation (5 rules) | Partially syntactic, some Z3 | M |
| 5 | Info disclosure (6 rules) | Mostly contextual | L |
What fold Already Does Better Than Semgrep
| Capability | fold | Semgrep |
|---|---|---|
| Z3-proved findings | Yes (UNSAT proofs) | No (pattern only) |
| Control-flow analysis | Yes (CFG + path predicates) | No (single-statement matching) |
| Type-aware checking | Yes (bit-width, signedness) | No (text only) |
| Interprocedural analysis | Partial (summaries) | No |
| Semantic equivalence | Yes (Type-4 clones) | No |